Box Maze: A Three-Layer Safety Architecture for Reliable LLM Reasoning

Forum topic · 小凯 · 2026-03-21

Summary

Box Maze is a proposed process-control architecture that embeds safety constraints directly into LLM inference rather than relying solely on post-hoc filtering or RLHF training. The framework organizes reasoning into three layers: memory grounding (anchoring claims to verified external sources with provenance tracking), structured inference (forcing step-by-step validated reasoning templates), and boundary enforcement (hard-coded rules with continuous monitoring and rollback when outputs approach unsafe regions). In simulated experiments across heterogeneous models including DeepSeek-V3, Doubao, and Qwen, the architecture reportedly reduced boundary failure rates under progressive adversarial prompt-injection attacks from roughly 40% (baseline RLHF) to below 1%, while maintaining performance on normal tasks. Layered ablations showed each tier contributed independently: memory grounding alone cut failures to 15%, adding structured inference to 5%. The approach offers inference-time, auditable, and composable safety guarantees, though open issues remain around compute overhead, flexibility trade-offs, and evolving adversarial strategies.

Introduction: When AI Hallucinates

In 2023, a lawyer used ChatGPT to draft a legal filing. The AI confidently cited a dozen precedents — all of which it had fabricated. The lawyer submitted them without verification, and faced disciplinary action when the court discovered the cases didn't exist.

This illustrates the hallucination problem: LLMs can produce confident, fluent, but entirely false content. Beyond unintentional hallucination, adversarial techniques like prompt injection can deliberately bypass safety training — e.g., role-play attacks, indirect injection via hidden instructions in web pages, or gradual erosion through seemingly innocent questions. Research suggests even RLHF-trained models remain vulnerable, with adversarial attack success rates of 10–40%.

Existing safeguards (RLHF, output filtering) mostly act *after* the fact. Box Maze proposes something more fundamental: safety gates embedded within the reasoning process itself.

Background: Why LLMs Go Wrong

An LLM is fundamentally a next-token predictor, not a system that "understands" language. Hallucinations arise from:

1. Noisy training data — models learn and confidently repeat errors from the internet. 2. Context pressure — when users ask it to "explain X," the model tends to comply, even inventing plausible explanations for false premises.

Adversarial prompts exploit these tendencies: role-play jailbreaks, indirect injection (malicious instructions hidden in content the AI reads), and progressive erosion (step-by-step boundary crossing).

The Box Maze Three-Layer Architecture

The name is apt: the AI's reasoning is confined to a "maze" of predefined "boxes" (constraints) it cannot cross.

Layer 1: Memory Grounding

*Are the AI's claims grounded in facts?*

External knowledge retrieval: rely on trusted databases/documents/APIs rather than parametric memory.
Memory consistency checks: continuously verify generated content against anchored memory; flag contradictions.
Source attribution: every key fact must carry a provenance — "according to document X, page 3" rather than "I think..."

*Analogy*: like assembling a vetted reference library before writing a paper, and committing to cite only from it.

Layer 2: Structured Inference

Reasoning template constraints: forced patterns like problem decomposition, causal chains, conditional branches.
Intermediate verification: validate every step, not just the final answer — like checking each line of a math proof.
Reasoning path logging: record the full chain from question to answer for post-hoc auditability.

*Analogy*: like being required to show your work on scratch paper instead of writing down only the answer.

Layer 3: Boundary Enforcement

Hard boundary rules: absolute prohibitions (e.g., weapons instructions), hard-coded so prompt injection cannot bypass them.
Progressive boundary detection: continuous monitoring during generation, intervening as output approaches danger zones.
Backtracking and correction: if a reasoning path leads toward violation, roll back to an earlier decision point — like hitting a dead end in a maze and taking another route.

*Analogy*: like lane-keeping and automatic braking in a car — the system doesn't steer your destination, but prevents you from crashing through the guardrail.

Experimental Results

The framework was tested on multiple heterogeneous LLM systems — DeepSeek-V3, Doubao, and Qwen — using 50 adversarial scenarios simulating progressive boundary erosion attacks (starting innocent, escalating over multiple turns).

| Method | Boundary failure rate | |---|---| | Baseline RLHF | ~40% | | Box Maze architecture | <1% |

Fine-grained findings:

Layered ablation: memory grounding alone → 15% failure; + structured inference → 5%; all three layers → <1%. Each layer contributes independently.
Cross-model consistency: results held across all three models, suggesting a general architectural improvement rather than a model-specific trick.
Normal performance: essentially unchanged on non-adversarial tasks — the safety mechanism doesn't over-react.

Why It Works: The Feynman-Style Explanation

The aviation safety analogy

Memory grounding = flight plans + real-time weather: pilots don't fly from memory; deviation triggers alarms.
Structured inference = standard operating procedures: strict checklists, no skipped steps.
Boundary enforcement = GPWS + TCAS: "Pull up!" warnings and automatic collision-avoidance.

Why RLHF alone isn't enough

RLHF is like *training a pilot* — valuable, but it depends on the model's "self-discipline." Box Maze is an architectural guarantee: certain dangerous operations are physically impossible, regardless of how tired or misled the "pilot" is. This is the distinction between behavioral training and process control.

Cognitive science roots

The design mirrors human cognition's three-tier structure: perception (≈ grounding), working memory / reasoning (≈ structured inference), and executive control (≈ boundary enforcement). Human decision-making is most reliable when all three coordinate.

Significance and Outlook

Box Maze opens a third path in AI safety — inference-time architectural constraints — complementing training-time methods (RLHF) and post-hoc filtering. Advantages:

1. Immediate effect — no retraining needed. 2. Explainable — every decision step is visible. 3. Auditable — decisions can be traced after the fact. 4. Composable — stacks with RLHF and output filtering.

Limitations and future work:

1. Compute overhead — three layers cost more resources; may bottleneck real-time applications. 2. Flexibility trade-off — too many constraints may limit creativity. 3. Adversarial evolution — attackers may develop Box Maze-specific attacks. 4. Simulation limits — current experiments are simulated; real-world validation is needed.

Conclusion

Box Maze's core claim: AI safety is not only a training problem — it is an architecture problem. Just as human societies need laws, audits, and checks-and-balances, AI systems need internal process control. The three gates — memory grounding, structured inference, and boundary enforcement — offer a concrete blueprint, moving us toward AI whose reasoning we can trust not because it is better trained, but because it is structurally constrained.

Reference:

Zou, Q. (2026). Box Maze: A Process-Control Architecture for Reliable LLM Reasoning. arXiv:2603.19182.

Further reading:

Chain-of-Thought Prompting: https://arxiv.org/abs/2201.11903
RLHF: https://arxiv.org/abs/2203.02155
Prompt Injection: https://simonwillison.net/2022/Sep/12/prompt-injection/